While reading on block ciphers and DES I read that two-round Feistel network is not a secure PRP? Is there any easy to understand proof to explain the intuition behind this statement. I did search around and also reviewed this question but wasn't really able to understand why it isn't secure PRP. Any help would be much appreciated!


1 Answer 1


I read that two-round Feistel network is not a secure PRP

That's easily seen:

                                    two-rounds Feistel cipher

It holds $P_L\oplus C_L=F_0(P_R)$. That implies a distinguishable property: for any fixed $P_R$ and whatever the round function $F_0$, when we flip bit(s) in $P_L$, that flips the corresponding bit(s) in $C_L$ and leaves the other bit(s) in $C_L$ unchanged.

That property allows a break under Chosen Plaintext Attack.

  • $\begingroup$ Perfect simple explanation that I was looking for! Thanks a lot! $\endgroup$
    – Alex
    Oct 25, 2020 at 20:51
  • $\begingroup$ Umm... Isn't that 1-round Feistel? $\endgroup$
    – hola
    May 30, 2021 at 6:26
  • $\begingroup$ @hola: the common way of counting rounds in Feistel ciphers is counting how many round functions there are. In the picture, there are two. $\endgroup$
    – fgrieu
    May 30, 2021 at 7:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.